From nobody Tue Dec 16 16:38:44 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1750065869; cv=none; d=zohomail.com; s=zohoarc; b=UFVUQ7n/pDCmE21gErU6Eye6IneOZ9ov/Gx912j8fPUdDSzY6yxd41WXwPNWS6V9EJbP9J/YdSpzRvuzcMD9vwCxGGY3OWsQw9cmAK+UKT0pla7/zOpXg8VsN1RdCVIcv/uNMJnbDDTrV/91ycuwYpf9IlOnaV4/ImFOHi6m5Ds= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1750065869; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=/57mASegoW8S7VeTMnJN+Cb99ND64Q2D44UkawBVIvY=; b=Ork2uRiK77QFJmbRmERxCNmy4Wd8/2LDxxUTxxVtVe+nPAzGso9Zjzjsh6wdHYkm4EAvFP6zRtudypXro0OfHQpo4fsrJ0G6irMswd1CsAGgDeI9APJfjFaqQrAJBXZ+ls+c4EUURF4MMjHS3J6iD4ZLrl9SXfBaBH8uGIACpm8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1750065869638610.9743532505925; Mon, 16 Jun 2025 02:24:29 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uR64B-0001W8-Sl; Mon, 16 Jun 2025 05:23:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uR63N-0000P1-Am for qemu-devel@nongnu.org; Mon, 16 Jun 2025 05:23:00 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uR63J-0005Je-LO for qemu-devel@nongnu.org; Mon, 16 Jun 2025 05:22:57 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-434-nyvLT8HWNpupm0VGxNkk_Q-1; Mon, 16 Jun 2025 05:22:49 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 2B05818011CD; Mon, 16 Jun 2025 09:22:47 +0000 (UTC) Received: from blackfin.pond.sub.org (unknown [10.45.242.11]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 7686C195608D; Mon, 16 Jun 2025 09:22:46 +0000 (UTC) Received: by blackfin.pond.sub.org (Postfix, from userid 1000) id D3BA921E6935; Mon, 16 Jun 2025 11:22:41 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1750065772; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/57mASegoW8S7VeTMnJN+Cb99ND64Q2D44UkawBVIvY=; b=DhR1HIXaFPxcXHW9YdYgVi/dpfyRzYbeGyw8ryUhJNdAvJsndhEiqNPyBmBUEf8Hc4fP+F 0hNysyCXLlb+hnHcnkZJS5v+n0pMXTXU2wB9z/1hlyqyAad/X984jCz4xUUYDcN99qxMsC s8dcRutqGNOMSJwgtbkOLxTAQ270Lbs= X-MC-Unique: nyvLT8HWNpupm0VGxNkk_Q-1 X-Mimecast-MFC-AGG-ID: nyvLT8HWNpupm0VGxNkk_Q_1750065767 From: Markus Armbruster To: qemu-devel@nongnu.org Cc: =?UTF-8?q?Daniel=20P=20=2E=20Berrang=C3=A9?= , Thomas Huth , =?UTF-8?q?Alex=20Benn=C3=A9e?= , "Michael S . Tsirkin" , Gerd Hoffmann , Mark Cave-Ayland , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Kevin Wolf , Stefan Hajnoczi , Alexander Graf , Paolo Bonzini , Richard Henderson , Peter Maydell Subject: [PATCH v5 3/3] docs: define policy forbidding use of AI code generators Date: Mon, 16 Jun 2025 11:22:41 +0200 Message-ID: <20250616092241.212898-4-armbru@redhat.com> In-Reply-To: <20250616092241.212898-1-armbru@redhat.com> References: <20250616092241.212898-1-armbru@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=armbru@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1750065873666116600 From: Daniel P. Berrang=C3=A9 There has been an explosion of interest in so called AI code generators. Thus far though, this is has not been matched by a broadly accepted legal interpretation of the licensing implications for code generator outputs. While the vendors may claim there is no problem and a free choice of license is possible, they have an inherent conflict of interest in promoting this interpretation. More broadly there is, as yet, no broad consensus on the licensing implications of code generators trained on inputs under a wide variety of licenses The DCO requires contributors to assert they have the right to contribute under the designated project license. Given the lack of consensus on the licensing of AI code generator output, it is not considered credible to assert compliance with the DCO clause (b) or (c) where a patch includes such generated code. This patch thus defines a policy that the QEMU project will currently not accept contributions where use of AI code generators is either known, or suspected. These are early days of AI-assisted software development. The legal questions will be resolved eventually. The tools will mature, and we can expect some to become safely usable in free software projects. The policy we set now must be for today, and be open to revision. It's best to start strict and safe, then relax. Meanwhile requests for exceptions can also be considered on a case by case basis. Signed-off-by: Daniel P. Berrang=C3=A9 Reviewed-by: Kevin Wolf Reviewed-by: Stefan Hajnoczi Reviewed-by: Alex Benn=C3=A9e Signed-off-by: Markus Armbruster --- docs/devel/code-provenance.rst | 55 +++++++++++++++++++++++++++++++++- 1 file changed, 54 insertions(+), 1 deletion(-) diff --git a/docs/devel/code-provenance.rst b/docs/devel/code-provenance.rst index c25afed98d..b5aae2e253 100644 --- a/docs/devel/code-provenance.rst +++ b/docs/devel/code-provenance.rst @@ -282,4 +282,57 @@ boilerplate code template which is then filled in to p= roduce the final patch. The output of such a tool would still be considered the "preferred format", since it is intended to be a foundation for further human authored changes. Such tools are acceptable to use, provided there is clearly defined copyri= ght -and licensing for their output. +and licensing for their output. Note in particular the caveats applying to= AI +content generators below. + +Use of AI content generators +~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +TL;DR: + + **Current QEMU project policy is to DECLINE any contributions which are + believed to include or derive from AI generated content. This includes + ChatGPT, Claude, Copilot, Llama and similar tools.** + +The increasing prevalence of AI-assisted software development results in a +number of difficult legal questions and risks for software projects, inclu= ding +QEMU. Of particular concern is content generated by `Large Language Models +`__ (LLMs). + +The QEMU community requires that contributors certify their patch submissi= ons +are made in accordance with the rules of the `Developer's Certificate of +Origin (DCO) `. + +To satisfy the DCO, the patch contributor has to fully understand the +copyright and license status of content they are contributing to QEMU. Wit= h AI +content generators, the copyright and license status of the output is +ill-defined with no generally accepted, settled legal foundation. + +Where the training material is known, it is common for it to include large +volumes of material under restrictive licensing/copyright terms. Even where +the training material is all known to be under open source licenses, it is +likely to be under a variety of terms, not all of which will be compatible +with QEMU's licensing requirements. + +How contributors could comply with DCO terms (b) or (c) for the output of = AI +content generators commonly available today is unclear. The QEMU project = is +not willing or able to accept the legal risks of non-compliance. + +The QEMU project thus requires that contributors refrain from using AI con= tent +generators on patches intended to be submitted to the project, and will +decline any contribution if use of AI is either known or suspected. + +This policy does not apply to other uses of AI, such as researching APIs or +algorithms, static analysis, or debugging, provided their output is not to= be +included in contributions. + +Examples of tools impacted by this policy includes GitHub's CoPilot, OpenA= I's +ChatGPT, Anthropic's Claude, and Meta's Code Llama, and code/content +generation agents which are built on top of such tools. + +This policy may evolve as AI tools mature and the legal situation is +clarifed. In the meanwhile, requests for exceptions to this policy will be +evaluated by the QEMU project on a case by case basis. To be granted an +exception, a contributor will need to demonstrate clarity of the license a= nd +copyright status for the tool's output in relation to its training model a= nd +code, to the satisfaction of the project maintainers. --=20 2.49.0